Group-IB Details Milk Dragon Kit That Steals Cards and MFA Codes

Group-IB says Milk Dragon, also called NaiLong, steals card data and relays 3-D Secure codes through fake stores.

Group-IB reported that Milk Dragon, also known as NaiLong, is a phishing-as-a-service kit active since October 2025. Discount posts on Facebook and TikTok, along with marketplace ads and other social posts, send shoppers to fraudulent WordPress and WooCommerce stores impersonating brands including LEGO, Calvin Klein, and Aeon Malaysia. A malicious plugin called BytePress inserts fake card and PayPal checkout options and streams entered data, including keystrokes, to operators over Socket.IO WebSockets. Operators then relay legitimate 3-D Secure prompts, drawing on 36 banking templates, to capture one-time codes. Researchers counted 258 phishing pages tied to victims in 66 countries and impersonation of 21 brands. Both reports agree on the start date, page and country counts, template count, and Telegram pricing from 300 USDT per month, which includes an operator panel and live session monitoring.

• Group-IB reported the Milk Dragon phishing-as-a-service kit, also called NaiLong, active since October 2025.
• Researchers linked 258 phishing pages to victims in 66 countries.
• The kit uses 36 banking templates and impersonates 21 brands, including LEGO, Calvin Klein, and Aeon Malaysia.
• Discount posts on Facebook and TikTok, plus marketplace ads and other social posts, send shoppers to fake WordPress and WooCommerce stores.
• The BytePress plugin adds fake card and PayPal checkout options and streams entered data, including keystrokes, over Socket.IO WebSockets.
• Operators proxy legitimate 3-D Secure challenges to capture one-time codes and can monitor live sessions from an operator panel.
• Subscriptions have been sold on Telegram from 300 USDT per month.